CVE-2024-34066 - CVE House

Back to Database

Status published High CVE-2024-34066

Arbitrary File Write/Read in Pterodactyl wings

8.5 CVSS

Vulnerability Description

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34066

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pterodactyl

View All →

Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances

Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

Pterodactyl TOTPs can be reused during validity window

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Affected Vendor

pterodactyl

View all reports →

Affected Software

wings

Vulnerable Versions:

< 1.11.12

Timeline

Official Publish: May 3rd, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1083 File and Directory Discovery

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel

T1565 Data Manipulation